{"id":"CVE-2018-0101","published":"2018-01-29T20:00:00Z","modified":"2024-12-02T21:25:00Z","title":"A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA)…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"Cisco Adaptive Security Appliance","versions":["Cisco Adaptive Security Appliance"]}],"description":{"text":"A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a region of memory when the webvpn feature is enabled on the Cisco ASA device. An attacker could exploit this vulnerability by sending multiple, crafted XML packets to a webvpn-configured interface on the affected system. An exploit could allow the attacker to execute arbitrary code and obtain full control of the system, or cause a reload of the affected device. This vulnerability affects Cisco ASA Software that is running on the following Cisco products: 3000 Series Industrial Security Appliance (ISA), ASA 5500 Series Adaptive Security Appliances, ASA 5500-X Series Next-Generation Firewalls, ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers, ASA 1000V Cloud Firewall, Adaptive Security Virtual Appliance (ASAv), Firepower 2100 Series Security Appliance, Firepower 4110 Security Appliance, Firepower 9300 ASA Security Module, Firepower Threat Defense Software (FTD). Cisco Bug IDs: CSCvg35618.","provenance":"source","from":"CVE.org"},"summary":{"text":"A double-free flaw in the SSL VPN (WebVPN) functionality of Cisco Adaptive Security Appliance (ASA) Software, present on ASA 5500 and 5500-X Series, Firepower 2100/4110/9300 ASA modules, Firepower Threat Defense, and other listed Cisco platforms, occurs when the webvpn feature is enabled. An unauthenticated remote attacker who can send crafted XML packets to a webvpn-configured interface can cause the device to reload or execute arbitrary code and gain full control of the system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:42Z"},"cvss":null,"epss":{"score":0.8678,"percentile":0.99742,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2018-01-29","exploitedFirstSeen":"2018-01-29","ransomware":false,"evidence":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1","date":"2018-01-29"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"CVE Data","url":"https://otx.alienvault.com/pulse/69929b597293fe5837b9c95c","created":"2026-02-16"},{"name":"New espionage-focused campaign found targeting perimeter network devices","url":"https://otx.alienvault.com/pulse/66293c5ba5061148326e0b76","created":"2024-04-24"}],"provenance":"machine"},"cwes":[{"id":"CWE-415","name":"Double Free"}],"references":[{"url":"https://icanthackit.wordpress.com/2018/01/30/thoughts-on-the-handling-cve-2018-0101-cisco-bug-cscvg35618/","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/102845","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id/1040292","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.exploit-db.com/exploits/43986/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://pastebin.com/YrBcG2Ln","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"}],"reports":[{"id":"SRC-78e2285773915bb291c1","title":"ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices","publisher":"blog.talosintelligence.com","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","date":"2024-04-24","mentions":[{"quote":"Note that the use of this field does not indicate the exploitation of CVE-2018-0101 which was NOT used as a component of this campaign.","start":5417,"end":5552}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-0925","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-0925","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":43986,"url":"https://www.exploit-db.com/exploits/43986","title":"Cisco ASA - Crash (PoC)","type":"dos","platform":"hardware","date":"2018-02-07","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2018-02-07"},"pocGithub":{"count":2,"skipped":0,"earliest":"2018-02-07","earliestUrl":"https://github.com/1337g/CVE-2018-0101-DOS-POC","repos":[{"name":"Cymmetria/ciscoasa_honeypot","url":"https://github.com/Cymmetria/ciscoasa_honeypot","stars":55,"created":"2018-02-08"},{"name":"1337g/CVE-2018-0101-DOS-POC","url":"https://github.com/1337g/CVE-2018-0101-DOS-POC","stars":14,"created":"2018-02-07"}]},"first":{"date":"2018-02-07","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/43986"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/43986/"],"flow":[{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-01-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2018-0101","provenance":"source"},{"date":"2018-01-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180129-asa1","provenance":"source"},{"date":"2018-02-07","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-43986); later: PoC-in-GitHub 2018-02-07","url":"https://www.exploit-db.com/exploits/43986","provenance":"source"},{"date":"2024-04-24","kind":"report","label":"Named in blog.talosintelligence.com: ArcaneDoor - New espionage-focused campaign found targeting perimeter network devi…","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/","provenance":"machine"}],"speed":{"daysToPublicExploit":9,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":64.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3195 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}